在Rails中使用有关密码处理的API来提高Android应用程序的安全性

Question

I'm new at my job and I'm in charge of improving an Android app and the API this app use because the last developer left the company.

Right now the app is pretty small, according to Google Play Store less than 500 people have installed it, but something that worries me is that I realized that the guy who developed this app in Android saved the passwords of the users in the phone in plain text with localStorage.setItem , then everytime an user wants to log in he recover the password with localStorage.getItem and send it to the API. In the Rails API the password is handled much more securely, but he made the authentication with a GET request (honestly, he used GET for everything, editing resources, creating resources, etc.), and although he used HTTPS, the API could also accept HTTP requests.

I'm no security expert, but obviously this is pretty bad...

What can I do in the short term to improve the security of this application?

• For now I made the API to only accept HTTPS requests.
• I'm planning in change the GET requests for POST when appropriate.
• I also plan to save the Hash of the password when the user sign up and then use this Hash like if it were the real password.

As I said, I'm not an expert in security, but I do not want to do things as bad as the previous developer, so I want to hear more opinions, what else can I do to improve the security of the application in Rails and Android? How can I handle sensitive information more carefully?

Greetings.

Answer 1

This is not the worst issue in the world, the password should be securely transmitted over https. The main problem is it is impossible to invalidate sessions without changing your password. Say you login on a device and then later from another device you want to log out the first one but you don't have access to the first device than you are unable to log out the first device without changing your password. Using a hashed password stored on the client is no better because the hash has now become the password.

How it should be done and how most websites do it is you send your username/password to the login api and the login api returns an auth token. The auth token is then used to authenticate all api requests from now on. The benefit of this is the auth token can be invalidated by the server and the session expires which blocks the device from accessing the api until it has logged in again.

One popular library for this is devise_token_auth which handles all of this for you.

But if your app has no way to list the active sessions and invalidate them then you gain nothing from this. Again, sending the password through https to your server is not particularly unsafe. An apps private storage area can not be accessed by other apps and if the device is compromised so this area is not safe then there is nothing you can do anyway.